Security
Last updated 15 October 2026.
Clean Vendor Check holds your vendor list and the evidence your auditor will rely on. This page describes how we protect them. To report a security issue, contact us at procurementexpress.com.
Where your data lives
The service runs on Vercel and stores data in a Neon Postgres database, both in the United States (US East). All traffic to the service uses HTTPS. Our database provider encrypts data at rest.
Signing in
- There are no passwords to steal or reuse. You sign in with a 6-digit code or a one-time link sent to your work email. Each works once, expires after 15 minutes and allows five attempts.
- Sign-in sessions use a secure, HTTP-only cookie and last up to 30 days. Signing out ends the session.
- API keys, sign-in codes and links, and AI assistant access tokens are stored only as one-way hashes, so a copy of our database wouldn't reveal them. You can revoke API keys and disconnect assistants in Settings.
- AI assistants connect with OAuth 2.1 and PKCE. You approve each connection, and access tokens expire after an hour.
Protecting what you enter
- Inputs and uploads that look like an SSN, EIN or TIN are rejected or removed before anything is stored.
- Raw rows from an uploaded file are deleted once you confirm the upload, or after 7 days if you don't.
- Requests that change data must come from our own pages, which protects against cross-site request forgery. Pages can't be framed by other sites.
- Sign-in, anonymous checks, verification pages and UEI request links are rate-limited.
- Alert webhooks must use HTTPS.
- Card payments are handled entirely by Stripe.
Evidence you can trust
- Every evidence record is fingerprinted with SHA-256 when it's created and chained to the record before it, so a record can't be edited or backdated without breaking the chain.
- Each record names the SAM.gov extract file it was checked against and that file's SHA-256 fingerprint.
- Anyone with a record's ID can confirm on its public verification page that the record is authentic and unaltered.
- The matching method is published on our methodology page.
Sign-in codes, alerts and UEI requests are sent through Postmark. We turn off open and link tracking, so links in our emails go straight to us.
Reporting a vulnerability
If you think you've found a security problem, contact us at procurementexpress.com with the details. Please give us a reasonable time to fix it before telling anyone else, and don't access data that isn't yours.